There is always the risk of an attacker infiltrating the company to write vulnerabilities or a government forcing the cloud provider to write malicious code in order to degrade security. That's what the U.S. government almost succeeded at forcing Apple to do in the wake of the San Bernardino case.

A local vault is better than a cloud vault, but if that local vault software is written by a commercial company there's still that risk.